Federal AI policy. Three documents. No federal law.

01 / The federal landscape today

Sector law plus voluntary frameworks plus active litigation.

The US has no horizontal federal AI law. What it has is a layered set of rules that overlap with AI use without being AI-specific.

• Sector-specific federal rules: FDA software-as-a-medical-device guidance, FTC actions on deceptive AI claims, EEOC guidance on AI in employment, CFPB action on credit decisioning.
• Voluntary frameworks: NIST AI RMF (the operational baseline), ISO/IEC 42001 (the certifiable management system).
• Existing federal statutes that apply to AI use without naming AI: civil rights laws, ECPA, HIPAA, GLBA, COPPA, the Communications Decency Act.
• Constitutional litigation: the Trump administration's task force is now arguing that state AI laws unconstitutionally regulate interstate commerce.

This is the "federal floor is a series of patches" scenario. Compliance teams have to read each AI use against multiple authorities, none of which is fully harmonized with the others.

02 / The December 2025 executive order

"Ensuring a National Policy Framework for Artificial Intelligence."

President Trump signed the executive order in December 2025. The operational consequences:

• Declared a uniform federal policy framework for AI as the goal.
• Directed the US Attorney General to establish a task force to challenge state AI laws on grounds of unconstitutional regulation of interstate commerce or federal preemption.
• Directed federal agencies to align their AI procurement and use with the framework.
• Set out priorities for streamlining federal AI regulation and reducing what the order called "AI compliance burden" on US businesses.

The EO is a litigation and rulemaking strategy. It is not a federal AI law. It cannot, on its own, overturn the Colorado AI Act, Texas TRAIGA, California's AI stack, or any other state law. The legal mechanisms that can overturn state law are an act of Congress (rare) or a federal court ruling that a specific state law violates the US Constitution (slow, fact-specific). Both tracks are now in motion.

Until those tracks resolve, organizations must continue to comply with state AI laws as they stand. The Northbeams editorial position: act on the law that exists; track the litigation; revisit your program if and when state laws fall.

03 / The March 2026 White House framework

A legislative wishlist for Congress.

In March 2026, the White House released a comprehensive national legislative framework for AI. Unlike the executive order, it does not bind anyone on its own. It is the administration's stated priorities for AI legislation, intended to push Congress toward a federal bill the administration would sign.

The framework covers four pillars:

• Child safety online. Federal rules around AI use that affects minors, particularly in social media and educational technology.
• Free speech protections. Limits on AI-driven content moderation and on government leaning on private platforms to moderate.
• AI scams. Federal enforcement against deepfake fraud, voice-cloning scams, and other AI-enabled financial harm.
• Intellectual property for creators. Rules on AI training data, watermarking, and provenance.

The framework signals where federal legislation is most likely to appear first. Compliance programs should track child-safety and IP-watermarking provisions especially closely if they touch the relevant verticals.

04 / The AI LEAD Act and pending bills

Product liability for AI.

The Artificial Intelligence Leadership and Economic Advancement and Development (AI LEAD) Act is the leading pending federal AI bill. It would establish a product liability framework for AI systems, defining the conditions under which providers and deployers can be held liable for AI-caused harm.

Other pending federal bills target narrower issues: AI in elections, deepfake disclosure, foundation-model risk reporting, federal AI procurement standards. Most have moved through committee but not to floor votes. Congress remains divided on the right shape of AI legislation.

Two patterns matter for compliance:

• Liability follows documentation. If product liability passes, the documentation you produced under state laws (Colorado impact assessments, Texas discrimination audits, EU AI Act technical files) becomes your liability defense. The records you keep now matter then.
• Federal preemption fights take years. Even if a federal bill passes, expect litigation over preemption scope. Companies that built compliance programs on state laws are in a stronger position than companies that waited.

05 / What this means for your compliance program

Build for state law. Build for the EU AI Act. Document for liability.

Three operational moves cover the federal uncertainty.

1. Continue to comply with state AI laws.

Until courts rule or Congress acts, the Colorado AI Act, Texas TRAIGA, California's AI stack, the New York RAISE Act, and the Illinois AI interview law remain enforceable. Audit, document, report.

2. Adopt a recognized framework.

NIST AI RMF or ISO/IEC 42001 (or both) gives you a portable evidence base. Most state laws recognize these as safe harbors. Federal liability legislation, if it passes, will likely defer to similar frameworks.

3. Document everything signed and dated.

If product liability comes, the impact assessment, the algorithmic discrimination audit, the consumer-notice procedure, and the signed audit log are the artifacts that protect you. Build them now under state-law obligations and they stack against federal liability later.